1. Field of Invention
This invention relates to the field of electronic mail (also referred to as email or simply as mail) security and more specifically, to a technique for protecting mail servers from mail flood attacks.
2. Description of Related Art
Unsolicited commercial email (UCE) (colloquially known as spam), viruses, and denial of service attacks threaten computer systems and networks. The problems of UCE and viruses have generally been considered on a single message basis. Most anti-UCE techniques, including content filtering and source interdiction, such as disclosed in commonly owned in U.S. patent application Ser. No. 10/972,765, consider each message separately even though the technique may use a history of electronic mail messages including UCE to better discern UCE from non-UCE. Processing these determinations consumes some resources and time.
A recent technique of spammers (senders of UCE) is to flood a given server with UCE. These attacks are frequently executed in an attempt to circumvent a popular anti-UCE technique known as “tempfailing” or “greylisting.” While the anti-UCE techniques used will hopefully catch these messages, the processing of each of these messages consumes valuable resources and time that could be used more efficiently to process legitimate electronic mail messages. Furthermore, spammers employing this technique frequently modify the content of their UCE on each successive attempt in the hope that the variation is sufficient to permit the UCE past the anti-UCE measures of the recipient. While these “mail flood” attacks are persistent they usually do not rise to the frequency that would trigger a denial of service countermeasure.
One method of controlling a mail flood attack is to limit the number of simultaneous connections permitted to the mail server. However, this form of connection throttling has the unintended impact of throttling legitimate attempts to deliver mail. Another variation is to limit the number of simultaneous connections permitted from any single Internet protocol (IP) address. This may limit to some extent the mail flood connections, but experience has shown that most spammers have multiple IP addresses at their disposal. Also, simultaneous mail flood attacks do not occur at such a high frequency that such a restriction would be very useful. A typical attack could be 200-300 messages attempted 10 seconds apart. Additionally, when transmitting to large commercial mail systems, many legitimate email servers attempt to establish many simultaneous connections to those systems. For instance, at any given time, there are many emails traversing between the ebay.com and yahoo.com systems and an intelligent anti-mail flood system needs to account for this.